Splunk Search

How to add trend to event counts?

ReachDataScient
Explorer

I have the below search which shows 3 columns....the field1, index list and count of events. How can I add a trend line or a spark line to show if the event count is increasing or decreasing.

| tstats count by index 
| join index type=inner 
| inputlookup LookUp1 
| eval index=lower(index) 
| table field1,index,count 
| sort field1 asc] 
| stats list(index) as index, sum(count) as count by field1
Tags (2)
0 Karma

philipmattocks
Path Finder

For a sparkline try:

| tstats count by index 
| join index type=inner 
[| inputlookup LookUp1 
| eval index=lower(index) 
| table field1,index,count 
| sort field1 asc] 
| stats list(index) as index, sum(count) as count, sparkline(sum(count)) as trend by field1

Let me know if that helps.

Philip

0 Karma

ReachDataScient
Explorer

I tried this before but for the sparkline it shows a flat line with 0 value all across.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...